Back to the Penn State Flock investigation

Ongoing investigation

Case Archive

New evidence, contract changes, and Penn State's responses since the original investigation published in January 2026.

Last updated April 2026

FEB 16
Flock rewrites contract
FEB 26
Penn State confirms cameras
FEB 27
5,773-network search logged

February 26, 2026

Confirmation

Penn State Confirms

WPSU reports what this investigation documented in January.

WPSU, February 26, 2026
Sara Thorndike, Penn State's chief financial officer, confirmed the use of the license plate readers in response to a question during a Faculty Senate meeting.

Source: WPSU · February 26, 2026

Penn State's official claims (via unnamed spokesman)

The pilot is "limited in scope and duration, with no contract or cost during the testing period."
Flock's standard model gives cameras away free during pilots. The cost starts when the pilot ends and the cameras are embedded in police workflows. The original investigation described this as the sustainability trap.
"Camera locations and counts are not published for security reasons."
The cameras are solar-powered units mounted on poles along public roads. DeFlock and this investigation have already mapped them. The "security" justification protects the deployment from public scrutiny, not from criminals.
"Access is restricted to trained, authorized (University Police and Public Safety) personnel."
Access to Penn State's cameras is restricted. Access through Penn State's cameras to thousands of other agencies' networks is not mentioned. And access by other agencies to Penn State's camera data through Flock's shared network is bidirectional.
"There is no public access to (automated license plate reader) data."
Correct. The public has no access to data about how their vehicles are being tracked. That is the problem.

Status

In January, the cameras were this site's claim. On February 26, 2026, Penn State's CFO confirmed the deployment at a Faculty Senate meeting, so the cameras are now the university's own admission. Who authorized them, and under what policy?

February 27, 2026

One day after WPSU article

The real query

The Real Investigation

The original investigation asked: "If a test query searches 96,504 devices, what does a real investigation look like?"

Networks Searched

5,773

Source: Penn State Police · 3:41 PM EST

Search Parameters

Operator	Penn State University Police and Public Safety PA
Search Window	30-day rolling
Stated Justification	Missing/Endangered Person
Case Number	Blank

How we know

Kyle, Texas PD publishes its Flock transparency logs. Those logs record every agency that queries the Flock network through Kyle's cameras. On February 27, 2026, the logs show Penn State Police as the querying agency.

Flock Search Log

Agency:: Penn State UPPS
Time:: 3:41 PM EST
Reason:: Missing/Endangered
Networks:: 5,773

Source: Kyle TX Police · Flock transparency logs

This search happened one day after WPSU published its article confirming the Flock deployment, and one day after Penn State's spokesman told reporters that "access is restricted to trained, authorized personnel" and that "system use is logged and audited."

The system is logged. That is how we found this.

The contradiction

What Penn State Told WPSU vs. What the Logs Show

What Penn State told WPSU	What the logs show
"There is no public access to automated license plate reader data."	The Flock network shares data bidirectionally. When Penn State searches other agencies' cameras, those agencies can search Penn State's cameras through the same network.
"Access is restricted to trained, authorized (University Police and Public Safety) personnel."	Penn State officers accessed data from 5,773 external networks. Officers at those agencies have reciprocal access to Penn State's camera data.
"Data are retained for up to 30 days unless preserved as evidence."	Penn State's 30-day policy applies to Penn State's cameras. The 5,773 agencies Penn State searched each set their own retention periods. Some retain data for years.

Source: Kyle TX Police · Flock transparency logsPenn State statements · WPSU

The contract

The Quiet Rewrite

February 16, 2026

On February 16, 2026, Flock rewrote its standard contract. They called it a "simplification."

The claim

"Customers own and control their data. That has not changed."

Source: Flock Safety Blog · February 17, 2026

What counts as "Customer Data"?

Dec 19, 2025

§1.3

Definition

"Customer Data" meant images, audio, video, and metadata available through the Web Interface.

"For clarity, Customer Data does not include the underlying raw Footage captured by the Flock Hardware or any Flock IP."

Agencies "owned" a processed subset. Flock kept the raw footage and everything derived from it.

Feb 16, 2026

§1.6

Definition

"Customer Data" now means all data captured by Flock Hardware, content input by users, and data from third parties at Customer's direction.

The raw footage exclusion is gone. Everything is "Customer Data" now.

Agencies "own" a broader category. Sounds better. Read the license.

What can Flock do with that data?

Dec 19, 2025

§4.1

License grant

Flock received a license to use Customer Data to "perform all acts as may be necessary for Flock to provide the Flock Services to Customer."

Feb 16, 2026

§4.1

License grant

Flock now receives a license to (a) "use and disclose Customer Data to provide the Flock Services" and (b) "use Customer Data to support and improve Flock's products and services."

	Dec 19, 2025	Feb 16, 2026
Scope	Provide services	Provide services + improve products
Duration	Not specified as perpetual	PERPETUAL
Purpose	Necessary acts only	Anything that "supports or improves"

What disappeared?

“Training Data” (Dec §1.17)

Removed

Was: A small fraction of images, stripped of all metadata and identifying information, used for improving Flock Services through machine learning. “Never sold or shared with third parties.”

Eliminated. Folded into “Customer Data” with the broader perpetual license. The privacy safeguards described in the old Training Data section have no equivalent in the new terms.

“Customer Generated Data” (Dec §1.4)

Removed

Was: Content submitted by Customer through Flock Services. Flock had a separate limited license and did “not claim ownership.”

Eliminated. Folded into “Customer Data.” The separate non-ownership statement is gone.

“Data Distribution” (Dec §4.4)

Removed

Was: Described how Customer could choose to share data with third-party integrations, with a separate license grant.

Eliminated as a standalone section. The mechanics of data sharing between agencies through Flock’s network are no longer described in the terms.

Read the Contract, Not the Blog Post

In December, agencies owned a narrow slice of processed data. Flock needed that data only to run the cameras. Training data had explicit privacy protections. Raw footage stayed with Flock.

In February, agencies "own" everything. Flock gets a perpetual, irrevocable license to use all of it to "support and improve" any product Flock builds. The Training Data privacy safeguards are gone. The Data Distribution mechanics are gone.

Flock handed agencies a larger bucket labeled "yours" while writing itself a permanent key to that bucket. The agencies own the label. Flock controls the data.

Sources

Flock T&C (Dec 19, 2025)Flock T&C (Feb 16, 2026)Flock Blog (Feb 17, 2026)

Source: Flock Safety terms comparison · Dec. 19, 2025 / Feb. 16, 2026